Microsoft has confirmed that its Azure Linux distribution ships a vulnerable version of the LAN743x Ethernet driver, leaving systems exposed to a high-severity kernel bug tracked as CVE-2025-38422. But the company’s May 2025 security advisory stops short of attesting whether other Microsoft-distributed Linux images—including the kernel inside Windows Subsystem for Linux 2 (WSL2), Azure Marketplace appliances, and Azure Kubernetes Service (AKS) node images—also carry the same flawed code. For admins and developers who run Microsoft’s Linux offerings, that means one clear task: patch Azure Linux now, and scrutinize everything else yourself.
A Flaw Deep in the Ethernet Driver
At its core, CVE-2025-38422 is a correctness bug in the net/lan743x driver, which handles certain Microchip LAN743x PCIe Ethernet controllers. The driver miscounts the size of EEPROM and OTP memory regions on the PCI1xxxx “hearthstone” family of chips. Before the upstream Linux kernel fix, it assumed a maximum OTP size of 8 KB and EEPROM size of 64 KB, but actual operations could stray beyond those boundaries, leading to out-of-bounds reads or writes.
Such memory mismanagement can kernel drivers can crash entire systems—a denial-of-service scenario—or, in the hands of a skilled attacker, become a stepping stone for privilege escalation. The risk isn’t a remote network worm; exploitation requires local access or a carefully crafted interaction with the hardware. But in cloud environments where virtual machines may have device passthrough or SR-IOV access, the stakes rise considerably.
The fix, merged into the upstream Linux kernel’s stable trees, forces the driver to report the actual EEPROM length based on the specific device, closing the out-of-bounds vector. Major Linux distributions, including Ubuntu and Amazon Linux, have already shipped patched kernels to their users. Early vendor assessments place the CVSS score in the high-severity range (around 7.8), reflecting the potential for privilege escalation when combined with other kernel vulnerabilities.
Who’s Affected?
Microsoft’s advisory answers one question definitively: “Azure Linux includes this open-source library and is therefore potentially affected.” Anyone running Azure Linux VMs or container hosts should treat this as a clear signal to apply updates immediately.
The advisory’s FAQ, however, reveals a critical gap. Microsoft began publishing machine-readable CSAF/VEX security attestations in October 2025, and it has—so far—only attested Azure Linux for this CVE. The company promises to update the entry “if impact to additional products is identified.” That phrasing is precise and temporary: absence of attestation is not proof of absence. Other Microsoft artifacts that ship Linux kernels remain in a gray area:
- WSL2: The kernel bundled with Windows Subsystem for Linux 2 is built and distributed by Microsoft. It tracks upstream releases and could include the lan743x driver, depending on kernel version and configuration. Microsoft hasn’t explicitly checked WSL2 for this CVE.
- Linux-azure and other Azure-tuned kernels: The
linux-azurepackage, often used in Azure VM images, may also contain the vulnerable driver if compiled from an affected upstream branch. - Marketplace and partner images: Many third-party images in the Azure Marketplace are based on Microsoft-provided base images or incorporate Microsoft kernels. Until each publisher attests separately, they’re unknowns.
- AKS node images: Managed Kubernetes nodes often run Azure-tuned kernels or custom builds; they may be vulnerable if they include the lan743x driver.
How We Got Here: Microsoft’s Transparency Push
Last October, Microsoft announced it would begin publishing Common Security Advisory Framework (CSAF) documents and Vulnerability Exploitability eXchange (VEX) statements for its products. The move was a response to years of enterprise frustration with vague, catch-all advisories that left defenders guessing which specific products were actually at risk. With CSAF/VEX, Microsoft promised machine-readable, product-level attestations—a “yes” or “not yet” for every CVE and every product.
CVE-2025-38422 is one of the first kernel-level CVEs to arrive under this new regime, and it illustrates both the power and the growing pains of the approach. Azure Linux, being Microsoft’s own first-party distribution, was inventoried first. The phased rollout, however, means that for the dozens of other Linux-flavored artifacts Microsoft ships—from WSL2 kernels to managed container images—the automated attestation machinery hasn’t yet spit out a verdict. Customers must bridge the gap with manual verification.
What to Do Now
If you run Azure Linux
Apply Microsoft’s published kernel updates immediately. The latest packages contain the fix. Use your standard package manager (dnf or tdnf), and reboot affected hosts. Because Microsoft has publicly attested the vulnerability, this is the fastest and most reliable remediation path.
If you use WSL2
Check your kernel version. Open a WSL terminal and run uname -r. If the version is older than the upstream fixed releases (typically any 6.1.y or 6.6.y stable kernel after the fix was merged), you may be at risk. You can update WSL’s kernel via Windows Update or by running wsl --update from an elevated command prompt. If you use a custom WSL kernel from Microsoft’s open-source releases, ensure you download a patched version.
If you run other Linux VMs in Azure (non-Azure Linux)
Inventory your kernels. On each VM, run:
- uname -r to get the version.
- modinfo lan743x or lsmod | grep lan743x to see if the driver is present as a module.
- If the driver might be built-in, check /boot/config-$(uname -r) for CONFIG_LAN743X.
If the driver exists and your kernel is older than a vendor-patched release, update to the latest available kernel from your distribution or image publisher. For Ubuntu images, apt-get update && apt-get upgrade should pick up the fix. For other distributions, follow their security advisory feeds.
If you rely on AKS or managed services
Contact Microsoft Support or check the AKS release notes for kernel version updates. Azure Linux–based node pools can be upgraded via the Azure CLI or portal. For Ubuntu-based node pools, Azure may not control the kernel directly; ensure you’re deploying a node image with the relevant Ubuntu security patches applied.
Automate future checks
If your organization ingests CSAF/VEX data, add Microsoft’s feed to your vulnerability management platform. This will automatically alert you when Microsoft attests other products for this or future CVEs—no more guesswork.
Temporary mitigations (last resort)
If you can’t reboot and the lan743x driver is a module, you can blacklist it (modprobe -r lan743x && echo "blacklist lan743x" > /etc/modprobe.d/blacklist-lan743x.conf). This will disable any LAN743x-based network interfaces, potentially taking your machine offline. Use only if patching is impossible in the short term.
Outlook: Clearer Signals Ahead
Microsoft’s shift to product-level vulnerability attestation is a net positive for security. It replaces ambiguous “all versions may be affected” statements with concrete, auditable inventories. But the transition is still a work in progress. For CVE-2025-38422, the Azure Linux attestation gives admins of that platform a crisp directive. For everyone else, it’s a reminder to look under the hood of every Linux artifact they pull from Microsoft—and to push for faster, broader attestation coverage. The company has committed to updating CVE entries as inventory efforts expand, so expect the advisory to evolve in the coming weeks. Until then, treat any unattested Microsoft Linux image as potentially vulnerable.